AI security is repeating endpoint security’s biggest mistake

AI security is currently focused on posture-based controls (checking configurations, access rules, and input filters), similar to how endpoint security relied on antivirus signatures in the early 2000s, but this approach is incomplete because the AI attack surface is expanding faster than teams can secure it. The article argues that organizations need to shift toward behavior-based detection, which monitors what AI systems actually do (API calls, data retrieval, system actions) rather than just checking if security policies are in place, because the blast radius of a compromised AI agent affects multiple systems downstream.